Most recent entries from all

bdu:2025-10615

BREW-serveit-CVE-2024-47220 — HTTP Request Smuggling in ruby webrick

Affected: Homebrew: serveit

An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."

certfr-2025-avi-0003 — De multiples vulnérabilités ont été découvertes dans les produits IBM. Certaines d'entre elles permettent à un attaquan…

certfr-2025-avi-0003

fkie_cve-2024-47220

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

GHSA-6f62-3596-g6w7 — HTTP Request Smuggling in ruby webrick

Affected: RubyGems: webrick

OESA-2024-2226 — rubygem-webrick security update

Affected: openEuler:24.03-LTS: rubygem-webrick, openEuler:22.03-LTS-SP4: rubygem-webrick, openEuler:22.03-LTS-SP3: rubygem-webrick, openEuler:20.03-LTS-SP4: rubygem-webrick, openEuler:22.03-LTS-SP1: rubygem-webrick

WEBrick is an HTTP server toolkit that can be configured as an HTTPS server, a proxy server, and a virtual-host server. Security Fix(es): An issue was discovered in the WEBrick toolkit through 1.8.1 for Ruby. It allows HTTP request smuggling by providing both a Content-Length header and a Transfer-Encoding header, e.g., "GET /admin HTTP/1.1\r\n" inside of a "POST /user HTTP/1.1\r\n" request. NOTE: the supplier's position is "Webrick should not be used in production."(CVE-2024-47220)

RHSA-2025:1227 — Red Hat Security Advisory: Logging for Red Hat OpenShift - 5.9.11

rsync: Info Leak via Uninitialized Stack Contents WEBrick: HTTP request smuggling

SUSE-SU-2024:3939-1 — Security update for ruby2.1

Security update for ruby2.1

UBUNTU-CVE-2024-47220

Affected: Ubuntu:Pro:16.04:LTS: ruby2.3, Ubuntu:Pro:18.04:LTS: ruby2.5, Ubuntu:Pro:20.04:LTS: ruby2.7, Ubuntu:22.04:LTS: ruby-webrick, Ubuntu:24.04:LTS: ruby-webrick, Ubuntu:25.10: ruby-webrick

Rejected reason: DO NOT USE THIS CVE RECORD. ConsultIDs: none. Reason: This record was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.

WID-SEC-W-2025-0001 — IBM DB2: Mehrere Schwachstellen

Ein entfernter oder lokaler Angreifer kann mehrere Schwachstellen in IBM DB2 on Cloud Pak for Data ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, Sicherheitsmaßnahmen zu umgehen oder einen Denial-of-Service-Zustand zu erzeugen.